i've gotten quite a few questions about 1 detail of the new CVS access control stuff: what about directories in /contributions/ modules/ that don't yet have projects associated with them? originally (i.e for about 24 hours), all commits/tags were prevented in such directories (under the influence of chx, i err'ed on the side of the tightest restrictions). ;) however, killes asked me to change this, and that happened yesterday morning. so, now all the commit access control stuff is only in place for directories that are associated with a published project node. this means that once someone has a cvs account, they can create new directories in the repository and commit their code. once it's there, they're free to create a project node that points to their new directory and wait for that to be published and approved. however, tagging *is* restricted to published projects. so, the workflow for adding a new project is: 0) contrib author applies for CVS account (as always) once approved... 1) contrib authors add their code to an available directory in CVS 2) author submits a project node pointing to their directory 3) site admin reviews the node, decides if it's a fork/duplicate, or worthy assuming it's good... 4) site admin publishes the node (this should be the _only_ way a project node gets published, but it's not. see http://drupal.org/node/64100) 5) now author has ability to branch/tag their code 6) based on branches/tags, project module creates appropriate tarballs (also see http://drupal.org/node/58066) does that make sense? anyone got any suggestions for improvement? anyone have an opinion where this should be documented? maybe i should just edit/clarify/exapand on http://drupal.org/node/7765? let me know... thanks, -derek (dww)