diff --git a/api/tangled/cbor_gen.go b/api/tangled/cbor_gen.go
index 9ce370a6..39193aae 100644
--- a/api/tangled/cbor_gen.go
+++ b/api/tangled/cbor_gen.go
@@ -5812,6 +5812,10 @@ func (t *Repo) MarshalCBOR(w io.Writer) error {
 		fieldCount--
 	}
 
+	if t.Labels == nil {
+		fieldCount--
+	}
+
 	if t.Source == nil {
 		fieldCount--
 	}
@@ -5889,27 +5893,40 @@ func (t *Repo) MarshalCBOR(w io.Writer) error {
 		return err
 	}
 
-	// t.Owner (string) (string)
-	if len("owner") > 1000000 {
-		return xerrors.Errorf("Value in field \"owner\" was too long")
-	}
+	// t.Labels ([]string) (slice)
+	if t.Labels != nil {
 
-	if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("owner"))); err != nil {
-		return err
-	}
-	if _, err := cw.WriteString(string("owner")); err != nil {
-		return err
-	}
+		if len("labels") > 1000000 {
+			return xerrors.Errorf("Value in field \"labels\" was too long")
+		}
 
-	if len(t.Owner) > 1000000 {
-		return xerrors.Errorf("Value in field t.Owner was too long")
-	}
+		if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("labels"))); err != nil {
+			return err
+		}
+		if _, err := cw.WriteString(string("labels")); err != nil {
+			return err
+		}
 
-	if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.Owner))); err != nil {
-		return err
-	}
-	if _, err := cw.WriteString(string(t.Owner)); err != nil {
-		return err
+		if len(t.Labels) > 8192 {
+			return xerrors.Errorf("Slice value in field t.Labels was too long")
+		}
+
+		if err := cw.WriteMajorTypeHeader(cbg.MajArray, uint64(len(t.Labels))); err != nil {
+			return err
+		}
+		for _, v := range t.Labels {
+			if len(v) > 1000000 {
+				return xerrors.Errorf("Value in field v was too long")
+			}
+
+			if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(v))); err != nil {
+				return err
+			}
+			if _, err := cw.WriteString(string(v)); err != nil {
+				return err
+			}
+
+		}
 	}
 
 	// t.Source (string) (string)
@@ -6107,16 +6124,45 @@ func (t *Repo) UnmarshalCBOR(r io.Reader) (err error) {
 
 				t.LexiconTypeID = string(sval)
 			}
-			// t.Owner (string) (string)
-		case "owner":
+			// t.Labels ([]string) (slice)
+		case "labels":
 
-			{
-				sval, err := cbg.ReadStringWithMax(cr, 1000000)
-				if err != nil {
-					return err
-				}
+			maj, extra, err = cr.ReadHeader()
+			if err != nil {
+				return err
+			}
+
+			if extra > 8192 {
+				return fmt.Errorf("t.Labels: array too large (%d)", extra)
+			}
+
+			if maj != cbg.MajArray {
+				return fmt.Errorf("expected cbor array")
+			}
 
-				t.Owner = string(sval)
+			if extra > 0 {
+				t.Labels = make([]string, extra)
+			}
+
+			for i := 0; i < int(extra); i++ {
+				{
+					var maj byte
+					var extra uint64
+					var err error
+					_ = maj
+					_ = extra
+					_ = err
+
+					{
+						sval, err := cbg.ReadStringWithMax(cr, 1000000)
+						if err != nil {
+							return err
+						}
+
+						t.Labels[i] = string(sval)
+					}
+
+				}
 			}
 			// t.Source (string) (string)
 		case "source":
diff --git a/api/tangled/tangledrepo.go b/api/tangled/tangledrepo.go
index dcd4dd5a..23532228 100644
--- a/api/tangled/tangledrepo.go
+++ b/api/tangled/tangledrepo.go
@@ -22,9 +22,10 @@ type Repo struct {
 	Description   *string `json:"description,omitempty" cborgen:"description,omitempty"`
 	// knot: knot where the repo was created
 	Knot string `json:"knot" cborgen:"knot"`
+	// labels: List of labels that this repo subscribes to
+	Labels []string `json:"labels,omitempty" cborgen:"labels,omitempty"`
 	// name: name of the repo
-	Name  string `json:"name" cborgen:"name"`
-	Owner string `json:"owner" cborgen:"owner"`
+	Name string `json:"name" cborgen:"name"`
 	// source: source of the repo
 	Source *string `json:"source,omitempty" cborgen:"source,omitempty"`
 	// spindle: CI runner to send jobs to and receive results from
diff --git a/appview/repo/repo.go b/appview/repo/repo.go
index 3e8953b8..370ac9ed 100644
--- a/appview/repo/repo.go
+++ b/appview/repo/repo.go
@@ -313,7 +313,6 @@ func (rp *Repo) RepoDescription(w http.ResponseWriter, r *http.Request) {
 				Val: &tangled.Repo{
 					Knot:        f.Knot,
 					Name:        f.Name,
-					Owner:       user.Did,
 					CreatedAt:   f.Created.Format(time.RFC3339),
 					Description: &newDescription,
 					Spindle:     &f.Spindle,
@@ -950,7 +949,6 @@ func (rp *Repo) EditSpindle(w http.ResponseWriter, r *http.Request) {
 			Val: &tangled.Repo{
 				Knot:        f.Knot,
 				Name:        f.Name,
-				Owner:       user.Did,
 				CreatedAt:   f.Created.Format(time.RFC3339),
 				Description: &f.Description,
 				Spindle:     spindlePtr,
@@ -1636,7 +1634,6 @@ func (rp *Repo) ForkRepo(w http.ResponseWriter, r *http.Request) {
 					Knot:      repo.Knot,
 					Name:      repo.Name,
 					CreatedAt: createdAt,
-					Owner:     user.Did,
 					Source:    &sourceAt,
 				}},
 		})
diff --git a/appview/state/router.go b/appview/state/router.go
index 493874e6..ab557a34 100644
--- a/appview/state/router.go
+++ b/appview/state/router.go
@@ -221,10 +221,7 @@ func (s *State) StringsRouter(mw *middleware.Middleware) http.Handler {
 		Db:         s.db,
 		OAuth:      s.oauth,
 		Pages:      s.pages,
-		Config:     s.config,
-		Enforcer:   s.enforcer,
 		IdResolver: s.idResolver,
-		Knotstream: s.knotstream,
 		Notifier:   s.notifier,
 		Logger:     logger,
 	}
diff --git a/appview/state/state.go b/appview/state/state.go
index 307a7315..1ff953fa 100644
--- a/appview/state/state.go
+++ b/appview/state/state.go
@@ -453,7 +453,6 @@ func (s *State) NewRepo(w http.ResponseWriter, r *http.Request) {
 					Knot:      repo.Knot,
 					Name:      repoName,
 					CreatedAt: createdAt,
-					Owner:     user.Did,
 				}},
 		})
 		if err != nil {
diff --git a/appview/strings/strings.go b/appview/strings/strings.go
index f1e4267c..ed642182 100644
--- a/appview/strings/strings.go
+++ b/appview/strings/strings.go
@@ -9,16 +9,13 @@ import (
 	"time"
 
 	"tangled.sh/tangled.sh/core/api/tangled"
-	"tangled.sh/tangled.sh/core/appview/config"
 	"tangled.sh/tangled.sh/core/appview/db"
 	"tangled.sh/tangled.sh/core/appview/middleware"
 	"tangled.sh/tangled.sh/core/appview/notify"
 	"tangled.sh/tangled.sh/core/appview/oauth"
 	"tangled.sh/tangled.sh/core/appview/pages"
 	"tangled.sh/tangled.sh/core/appview/pages/markup"
-	"tangled.sh/tangled.sh/core/eventconsumer"
 	"tangled.sh/tangled.sh/core/idresolver"
-	"tangled.sh/tangled.sh/core/rbac"
 	"tangled.sh/tangled.sh/core/tid"
 
 	"github.com/bluesky-social/indigo/api/atproto"
@@ -32,11 +29,8 @@ type Strings struct {
 	Db         *db.DB
 	OAuth      *oauth.OAuth
 	Pages      *pages.Pages
-	Config     *config.Config
-	Enforcer   *rbac.Enforcer
 	IdResolver *idresolver.Resolver
 	Logger     *slog.Logger
-	Knotstream *eventconsumer.Consumer
 	Notifier   notify.Notifier
 }
 
diff --git a/knotserver/ingester.go b/knotserver/ingester.go
index 696f5601..a9150760 100644
--- a/knotserver/ingester.go
+++ b/knotserver/ingester.go
@@ -141,7 +141,7 @@ func (h *Knot) processPull(ctx context.Context, event *models.Event) error {
 		return fmt.Errorf("rejected pull record: not this knot, %s != %s", repo.Knot, h.c.Server.Hostname)
 	}
 
-	didSlashRepo, err := securejoin.SecureJoin(repo.Owner, repo.Name)
+	didSlashRepo, err := securejoin.SecureJoin(ident.DID.String(), repo.Name)
 	if err != nil {
 		return fmt.Errorf("failed to construct relative repo path: %w", err)
 	}
@@ -191,7 +191,7 @@ func (h *Knot) processPull(ctx context.Context, event *models.Event) error {
 			Kind:        string(workflow.TriggerKindPullRequest),
 			PullRequest: &trigger,
 			Repo: &tangled.Pipeline_TriggerRepo{
-				Did:  repo.Owner,
+				Did:  ident.DID.String(),
 				Knot: repo.Knot,
 				Repo: repo.Name,
 			},
diff --git a/knotserver/util.go b/knotserver/util.go
index 2cb63053..54fa1fce 100644
--- a/knotserver/util.go
+++ b/knotserver/util.go
@@ -1,45 +1,9 @@
 package knotserver
 
 import (
-	"net/http"
-	"os"
-	"path/filepath"
-
 	"github.com/bluesky-social/indigo/atproto/syntax"
-	securejoin "github.com/cyphar/filepath-securejoin"
-	"github.com/go-chi/chi/v5"
 )
 
-func didPath(r *http.Request) string {
-	did := chi.URLParam(r, "did")
-	name := chi.URLParam(r, "name")
-	path, _ := securejoin.SecureJoin(did, name)
-	filepath.Clean(path)
-	return path
-}
-
-func getDescription(path string) (desc string) {
-	db, err := os.ReadFile(filepath.Join(path, "description"))
-	if err == nil {
-		desc = string(db)
-	} else {
-		desc = ""
-	}
-	return
-}
-func setContentDisposition(w http.ResponseWriter, name string) {
-	h := "inline; filename=\"" + name + "\""
-	w.Header().Add("Content-Disposition", h)
-}
-
-func setGZipMIME(w http.ResponseWriter) {
-	setMIME(w, "application/gzip")
-}
-
-func setMIME(w http.ResponseWriter, mime string) {
-	w.Header().Add("Content-Type", mime)
-}
-
 var TIDClock = syntax.NewTIDClock(0)
 
 func TID() string {
diff --git a/lexicons/repo/repo.json b/lexicons/repo/repo.json
index 8329074a..e8d1728f 100644
--- a/lexicons/repo/repo.json
+++ b/lexicons/repo/repo.json
@@ -12,7 +12,6 @@
         "required": [
           "name",
           "knot",
-          "owner",
           "createdAt"
         ],
         "properties": {
@@ -20,10 +19,6 @@
             "type": "string",
             "description": "name of the repo"
           },
-          "owner": {
-            "type": "string",
-            "format": "did"
-          },
           "knot": {
             "type": "string",
             "description": "knot where the repo was created"
@@ -42,6 +37,14 @@
             "format": "uri",
             "description": "source of the repo"
           },
+          "labels": {
+            "type": "array",
+            "description": "List of labels that this repo subscribes to",
+            "items": {
+              "type": "string",
+              "format": "at-uri"
+            }
+          },
           "createdAt": {
             "type": "string",
             "format": "datetime"
diff --git a/spindle/ingester.go b/spindle/ingester.go
index 161a64d6..dfc6c333 100644
--- a/spindle/ingester.go
+++ b/spindle/ingester.go
@@ -162,29 +162,29 @@ func (s *Spindle) ingestRepo(ctx context.Context, e *models.Event) error {
 
 		// no spindle configured for this repo
 		if record.Spindle == nil {
-			l.Info("no spindle configured", "did", record.Owner, "name", record.Name)
+			l.Info("no spindle configured", "name", record.Name)
 			return nil
 		}
 
 		// this repo did not want this spindle
 		if *record.Spindle != domain {
-			l.Info("different spindle configured", "did", record.Owner, "name", record.Name, "spindle", *record.Spindle, "domain", domain)
+			l.Info("different spindle configured", "name", record.Name, "spindle", *record.Spindle, "domain", domain)
 			return nil
 		}
 
 		// add this repo to the watch list
-		if err := s.db.AddRepo(record.Knot, record.Owner, record.Name); err != nil {
+		if err := s.db.AddRepo(record.Knot, did, record.Name); err != nil {
 			l.Error("failed to add repo", "error", err)
 			return fmt.Errorf("failed to add repo: %w", err)
 		}
 
-		didSlashRepo, err := securejoin.SecureJoin(record.Owner, record.Name)
+		didSlashRepo, err := securejoin.SecureJoin(did, record.Name)
 		if err != nil {
 			return err
 		}
 
 		// add repo to rbac
-		if err := s.e.AddRepo(record.Owner, rbac.ThisServer, didSlashRepo); err != nil {
+		if err := s.e.AddRepo(did, rbac.ThisServer, didSlashRepo); err != nil {
 			l.Error("failed to add repo to enforcer", "error", err)
 			return fmt.Errorf("failed to add repo: %w", err)
 		}
diff --git a/spindle/xrpc/add_secret.go b/spindle/xrpc/add_secret.go
index a196e14e..dc88d5b4 100644
--- a/spindle/xrpc/add_secret.go
+++ b/spindle/xrpc/add_secret.go
@@ -62,7 +62,7 @@ func (x *Xrpc) AddSecret(w http.ResponseWriter, r *http.Request) {
 	}
 
 	repo := resp.Value.Val.(*tangled.Repo)
-	didPath, err := securejoin.SecureJoin(repo.Owner, repo.Name)
+	didPath, err := securejoin.SecureJoin(ident.DID.String(), repo.Name)
 	if err != nil {
 		fail(xrpcerr.GenericError(err))
 		return
diff --git a/spindle/xrpc/list_secrets.go b/spindle/xrpc/list_secrets.go
index 535284fa..30b77e31 100644
--- a/spindle/xrpc/list_secrets.go
+++ b/spindle/xrpc/list_secrets.go
@@ -57,7 +57,7 @@ func (x *Xrpc) ListSecrets(w http.ResponseWriter, r *http.Request) {
 	}
 
 	repo := resp.Value.Val.(*tangled.Repo)
-	didPath, err := securejoin.SecureJoin(repo.Owner, repo.Name)
+	didPath, err := securejoin.SecureJoin(ident.DID.String(), repo.Name)
 	if err != nil {
 		fail(xrpcerr.GenericError(err))
 		return
diff --git a/spindle/xrpc/remove_secret.go b/spindle/xrpc/remove_secret.go
index 1f6b6aca..f5cbb434 100644
--- a/spindle/xrpc/remove_secret.go
+++ b/spindle/xrpc/remove_secret.go
@@ -56,7 +56,7 @@ func (x *Xrpc) RemoveSecret(w http.ResponseWriter, r *http.Request) {
 	}
 
 	repo := resp.Value.Val.(*tangled.Repo)
-	didPath, err := securejoin.SecureJoin(repo.Owner, repo.Name)
+	didPath, err := securejoin.SecureJoin(ident.DID.String(), repo.Name)
 	if err != nil {
 		fail(xrpcerr.GenericError(err))
 		return