CommentCount is the number of replies on the change.

IterateComments walks replies oldest-first.

IterateReviews walks reviews in reviewer-address order.

Review returns a reviewer's latest verdict, or nil.

ReviewCount is the number of reviewers who have weighed in (latest verdict per reviewer, on any head).

Stale reports whether a review no longer applies to the change's head.

CreateRepo registers a repo owned by actor.

Fork registers newID as a fork of srcID and copies the parent's current refs into the child's log, so the fork records exactly what it forked from. The objects are not copied: they never were on chain: so the child inherits the parent's mirrors as its initial fetch locators.

HasRepo reports whether the id is taken.

IterateNamespace walks the repos of one namespace in id order.

IteratePackages walks every claimed path in the forge, in path order.

IterateRepos walks repos in id order, newest-last, and stops when cb returns true. offset/count page the walk; count <= 0 means "to the end".

PackageAt returns the full claim for a path, or nil.

PackageCount is how many paths the whole forge claims.

PackageRepo is the lookup an explorer makes: given a deployed path, which repo claims to publish it. Returns "" when nobody does.

PublishPackage records that this repo publishes path, and indexes it forge-wide so PackageRepo can answer without scanning every repo.

Re-publishing the same path from the same repo overwrites the entry, which is what a redeploy is. Publishing a path another repo already claims is refused: silently moving it would let any repo owner capture another project's package path in an explorer.

Repo returns the repo, or nil.

Size is the number of repos.

UnpublishPackage withdraws the claim. The package stays on chain; only the repo's assertion about it goes away.

CommentCount is the number of replies on the issue.

IterateComments walks replies oldest-first.

Can reports whether a holds at least the given role.

Change returns a change by id, or nil.

CloseChange withdraws or rejects a change. Author or maintainer.

CommentChange appends a reply to a change request.

CommentIssue appends a reply. Closed issues still take comments (closing is a triage state, not a gag); an archived repo takes none.

CountApprovals counts approvals that still apply: cast by a writer or above, against the change's current head, and (unless the repo allows it) not the author's own.

CountBlocking counts writers who requested changes on the current head.

CutRelease records a release. The tag is the key and cannot be re-cut: a consumer that pinned v1.2.0 and got different bytes later has been lied to, and the whole point of a tag is that it does not move. Withdrawing one is YankRelease, which leaves it visible.

DeleteRef removes a ref by compare-and-swap. The ref disappears from the current state; the log keeps every object it ever pointed at.

Maintainer-only for an economic reason as much as a safety one: on gno.land the storage-deposit refund goes to whoever frees the bytes, not to whoever paid for them (`receiver := caller` in the vm keeper's deposit path, gno master 2026-09-19), so an open delete path pays for vandalism.

ForceSetRef moves a ref without an expectation. It needs RoleMaintainer and is permanently recorded as KindForce: the point is not to forbid a force-push (sometimes it is the right call) but to make one impossible to hide.

Issue returns an issue by id, or nil.

IterateChanges walks change requests newest-first.

IterateIssues walks issues newest-first.

IterateLog walks the log oldest-first.

IterateLogReverse walks the log newest-first, which is what a UI wants.

IterateMembers walks members in address order.

IteratePackages walks the paths this repo claims, in path order.

IterateRefs walks refs in name order.

IterateReleases walks releases newest-cut first.

Cut order, not tag order: tags are not required to be semver here (gno.land's own packages are v0 and v1), so there is no total order to sort by that would not be wrong for somebody. When they were cut is a fact the forge does know.

LatestRelease is the most recently cut release that is neither a prerelease nor yanked, or nil. "Most recently cut", never "highest version": see IterateReleases.

LogEntryAt returns one entry by sequence number, or nil.

LogHead is the digest of the last entry, "" for an empty log. Pin this value anywhere off chain and the whole history becomes falsifiable.

LogSize is the number of entries ever appended.

MemberCount is the number of members with an explicit role.

MergeChange moves TargetRef to mergedOID and records the move as one more entry in the reference log, tagged with the change it came from.

expectedTargetOID is a compare-and-swap on the target ref ("" when the ref does not exist yet): a change approved against one base cannot be merged onto a base that moved underneath it. mergedOID is computed off chain by whoever performs the merge: the chain records the claim, signed, ordered and attributed, and a client with the objects verifies that the result actually contains HeadOID.

OpenChange files a change request. Permissionless, like an issue: the proposal costs its author gas and deposit, and costs a maintainer nothing until they choose to look.

OpenChangeCount counts change requests still open.

OpenIssue files an issue. Permissionless by design.

OpenIssueCount counts issues still open.

PackageCount is how many paths this repo claims.

Ref returns the current state of a ref, or nil.

Counts for rendering.

Release returns one release by tag, or nil.

ReleaseCount is how many releases this repo has cut, yanked ones included.

ReviewChange records a verdict against the change's current head. Anyone may review; only a writer's approval counts toward the merge policy (see CountApprovals): an unprivileged review is signal, not authority.

RoleOf returns the member's role, RoleNone when not a member.

SetArchived freezes (or unfreezes) the repo. An archived repo takes no mutation except unarchiving: the log stays readable forever.

SetDefaultRef points the repo at another default branch.

SetDescription updates the one-line description.

SetIssueLabels replaces an issue's labels. Triage is a maintainer action.

SetIssueOpen closes or reopens an issue. The author can always close their own; maintainers can close anyone's.

SetMember grants or revokes a role. Admins manage members; only an owner may mint another owner, and the last owner cannot be demoted: a repo with no owner is a repo nobody can ever unarchive.

SetMirrors replaces the fetch locators. The first one is the canonical remote; the rest are fallbacks. The chain records them, it never fetches.

SetPolicy sets the merge policy: how many approvals a change needs, and whether the author's own approval counts.

SetRef moves a ref by compare-and-swap: expectedOID must be the tip the caller last saw ("" to create a ref that does not exist yet). This is git's --force-with-lease, except the lease is held by consensus rather than by the server you are pushing to, so a concurrent push cannot be silently lost and a rewritten history cannot be presented as if it had always been that way.

The chain cannot check that newOID descends from expectedOID: it has no objects. That check belongs to a client holding the repo, which is exactly why every move is recorded rather than merely applied.

UpdateChangeHead repoints an open change at a new object. The author may always update their own; a writer may update anyone's (the "maintainer pushed a fixup" case).

VerifyLog recomputes the whole digest chain and reports the first entry whose digest does not follow from its predecessor. It should be impossible on a live chain: it is here because a transparency log nobody can verify is just a log, and a client should be running this against the values it read back.

YankRelease marks a release withdrawn without deleting it.

Deleting would make a pinned version silently vanish, which reads to a consumer as "this was never published" rather than "do not use this".

String renders the role as the lowercase token used by the realm API.