Your repository, your network, your identity provider

Identity is asserted, never invented

SpecPad implements no authentication of its own. A proxy provider reads identity headers from an upstream you already run, and believes them only from configured peer addresses — a deployment naming no trusted peer refuses to start rather than defaulting to trusting everyone. An OIDC provider is available where you would rather it spoke to your identity provider directly.

Group claims map to a role per project. A principal holding no role in a project is refused that project without affecting the others.

Identity is not the git credential. The signed-in human is the commit author; a machine credential performs the push. Compromising a session yields no repository credential.

Everyone gets their own working copy

Each user holds a private server-side working copy of the allowlisted paths, so one person's uncommitted edits are invisible to everyone else. Edits autosave without being committed and survive leaving and returning.

Idle copies are reaped on a configurable schedule — but a copy holding uncommitted changes is never reaped, however long it has been idle. A removed copy is re-provisioned on next use, so reaping is not observable to someone who comes back.

The commit gate

Publishing is explicit. Before anything is committed the server structurally validates every changed document and runs the same governance the editor and the skill run — imported from the shared contract, never reimplemented, so the three cannot disagree.

The commit is authored as the signed-in human and carries its job trailer. It is rebased onto the branch and retried a bounded number of times when someone else got there first. Nothing is force-pushed and no history is rewritten.

Merging by identifier, never as text

SpecPad documents are never merged textually. A pure three-way merge keyed on stable identifiers combines changes to different fields of the same item without conflict, and reports a conflict per field — not per item — where both sides moved the same one.

A difference in item order is never a conflict. An item deleted on one side and modified on the other is reported rather than guessed, and the surviving item is kept. Where a conflict cannot be resolved the server returns it per field, and your local value stays in place so the document remains valid while you settle it.

Several repositories, one deployment

A company adopting SpecPad rarely has one repository. The server takes a list of projects, each with its own repository, branch and allowlist. Every request resolves to exactly one, and authorization is per project rather than per deployment — so the boundary between two teams is structural rather than filtered.

Presence and the upstream-moved signal are scoped to a project too: a subscriber never learns that another project's branch moved.

Confined by construction

Every read and write is confined to a configured path allowlist, and the working tree is sparse-checked-out to those paths — so files outside them are not merely refused, they are physically absent. Two independent defences on the highest-impact surface, deliberately.