diff --git a/Makefile b/Makefile
index 8157d27..a461bfa 100644
--- a/Makefile
+++ b/Makefile
@@ -7,67 +7,20 @@
 
 GOFLAGS := -trimpath
 
-# oapi-codegen runs via `go run` at a pinned version. The spec lives in cmd/openapi,
-# alongside the generated Go server (openapi.gen.go) and TypeScript types (api-types.ts).
-SPEC     := cmd/openapi.yaml
-OAPIGEN  := cmd/openapi.gen.go
-TSTYPES  := cmd/api-types.ts
-WEB      := ../../web/apps/simplegit
-WEBDIST  := $(WEB)/dist
-
-.PHONY: build gitctl test web clean openapi openapi-check proto proto-tools proto-check
+.PHONY: build gitctl test clean proto proto-tools proto-check
 
 # build the simplegit server into ./build.
 build:
-	@mkdir -p build
-	go build $(GOFLAGS) -o build/simplegit ./cmd/daemon
+	go build $(GOFLAGS) -o daemon ./cmd/daemon
 
 # build the ManageService TUI client into ./build.
 gitctl:
-	@mkdir -p build
-	go build $(GOFLAGS) -o build/gitctl ./cmd/gitctl
-
-# dev runs simplegit as the git host: JSON-RPC + smart-HTTP on :8093, SSH on
-# :2222. It verifies console-issued JWTs and authorizes via the simpleconsole
-# RBAC center at -auth, so start simpleconsole (`make dev` in ../simpleconsole)
-# FIRST -- simplegit fetches console's JWKS at startup. The bare-repo root is
-# shared with console (console -root's repos/ subdir == this -root). For a
-# zero-config single-service run with no console: `go run . -skip-auth`.
-ROOT := $(abspath ../..)
-DATA := $(ROOT)/.simplegit-data
-dev:
-	go run ./cmd -rpc 127.0.1.1:8093 -ssh 127.0.1.1:2222 -root $(DATA)/repos -auth http://127.0.1.1:8080
-
-dev0:
-	go run ./cmd -rpc 127.0.1.1:8093 -ssh 127.0.1.1:2222 -root $(DATA)/repos -skip-auth
+	go build $(GOFLAGS) -o gitctl ./cmd/gitctl
 
 # run all tests.
 test:
 	go test ./...
 
-# web builds the git console (vite) into web/dist.
-web: $(WEBDIST)/index.html
-
-$(WEBDIST)/index.html:
-	cd $(WEB) && bun run build
-
-clean:
-	rm -rf build $(WEBDIST)
-
-# openapi regenerates the mgmt Go server ($(OAPIGEN)) and the TS types
-# ($(TSTYPES)) from the spec ($(SPEC)), the single source of truth. Both
-# generated files live in cmd/; the web imports the TS types via the
-# @openapi alias (see web/vite.config.ts). Generated files are committed, so
-# a normal build does not run this.
-openapi:
-	cd cmd && go run github.com/oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen@v2.7.1 -config oapi-codegen.yaml openapi.yaml
-	cd $(WEB) && bunx openapi-typescript $(CURDIR)/cmd/openapi.yaml -o $(CURDIR)/cmd/api-types.ts
-
-# openapi-check regenerates in place and fails if a generated file drifts from
-# the spec (for CI).
-openapi-check: openapi
-	@git diff --exit-code -- $(OAPIGEN) $(TSTYPES) && echo "openapi: generated files up to date"
-
 # ---- Connect (crpc) contract for gitrpc ----
 # gitrpc/gitrpc.proto is the single source of truth for the gitrpc method set
 # -- a typed replacement for the hand-written JSON-RPC handlers in
diff --git a/state/db.go b/state/db.go
index 95e4770..39e7fad 100644
--- a/state/db.go
+++ b/state/db.go
@@ -92,18 +92,6 @@ func init() {
 	sql.Register(sqliteDriver, &sqlite.Driver{})
 }
 
-// Open parses a database URI, opens a migrated xorm engine, and returns it.
-// For SQLite it also creates the parent directory and pins the pool to a single
-// connection (SQLite serializes writes through one global lock; busy_timeout
-// covers cross-process contention).
-// func Open(root string, uri string) (*LocalState, error) {
-// 	driver, dsn, _, err := common.ParseDBURI(root, uri)
-// 	if err != nil {
-// 		return nil, err
-// 	}
-// 	return OpenWithDSN(root, driver, dsn)
-// }
-
 func OpenWithDSN(root string, driver string, dsn string) (*LocalState, error) {
 	engine, err := InitEngine(driver, dsn)
 	if err != nil {
@@ -118,14 +106,6 @@ func OpenWithDSN(root string, driver string, dsn string) (*LocalState, error) {
 	}, nil
 }
 
-// OpenSkipAuth returns a LocalState that bypasses the DB entirely: access
-// checks always pass, RepoPath resolves any path under root. For zero-config
-// local dev (-skip-auth); no DB URI needed. The host key is still loaded/created
-// on disk so SSH works.
-func OpenSkipAuth(root string) *LocalState {
-	return &LocalState{root: root, skipAuth: true}
-}
-
 // Signer returns the SSH host key, creating and persisting it on first use.
 // Cached so the key is stable for the process lifetime.
 func (s *LocalState) Signers() ([]ssh.Signer, error) {