Block a user
fix: serveFromStore does a guaranteed-miss S3 lookup on every cache hit
feat: wire the circuit breaker into the proxy fetch path
feat: cache upstream bearer tokens
perf: batch access-log writes instead of goroutine+insert per request
fix: coalesce concurrent cache-miss fetches (thundering herd)
fix: getenv treats an explicitly-empty value as unset
fix: isNetworkError should use errors.As, not a bare type assertion
fix: HEAD requests fetch and stream the full body
fix: GC has no grace period (TOCTOU with dedup uploads)
fix: blocklist fails open when a regex fails to compile
perf: compile remote match patterns once instead of per-request
fix: set timeouts on the upstream HTTP client
perf: stream proxied artifacts instead of buffering the full body in memory