Governance: gitolite-style settings repo for keys and access rules #5

New issue

Closed

opened 2026-08-09 16:27:52 +00:00 by a73x · 0 comments

a73x commented

2026-08-09 16:27:52 +00:00

(Migrated from git.a73x.sh)

Spec: docs/superpowers/specs/2026-08-09-repo-governance-design.md

settings.git holds conf/access.conf and keydir/.pub; pushing to it reconfigures the server. Identity is the basename of the key file with directories ignored, so keydir/laptop/alex.pub and keydir/desktop/alex.pub are both 'alex' - which is how one operator adds a second machine.

Rules are line-oriented and ordered first-match, with gitolite's refex semantics. An agent's grant is one prefix:

repo tools
    RW+                   =   @admins
    RW      refs/collab/  =   @agents
    R                     =   @all

refs/heads/ never appears in a contributor's rule. This is only sufficient once patches travel under refs/collab/*, so it depends on the revision-refs issue.

Wild repos ('repo agents/[a-z].*' with C = @agents, RW+ = CREATOR) let agents create their own namespaces without a central allocator, which removes the need for any server-level authority over repo creation.

A push to settings.git is validated before it takes effect - config must parse, keys must be well-formed, and at least one principal must retain RW+ on settings. This deletes the malformed-policy and bounded-staleness failure paths entirely.

Prerequisites: pass the authenticated principal into git-receive-pack's environment, and read the child's stderr (session.rs:708-716) which is currently piped and discarded. Wild repos also force the HTTP resolution rework, since discover is non-recursive (repos.rs:217) and HTTP resolves by final path component (repos.rs:241).

Removes server.toml; --repos-dir, --http-bind and --ssh-bind become startup flags.

Migrated from git-collab issue 20c577fc752ede71b8f1ab63a8644835e81d94a5.

Original author: a73x dev@a73x.sh.

Close reason: merged in patch b6dcbb7b

Spec: docs/superpowers/specs/2026-08-09-repo-governance-design.md settings.git holds conf/access.conf and keydir/<name>.pub; pushing to it reconfigures the server. Identity is the basename of the key file with directories ignored, so keydir/laptop/alex.pub and keydir/desktop/alex.pub are both 'alex' - which is how one operator adds a second machine. Rules are line-oriented and ordered first-match, with gitolite's refex semantics. An agent's grant is one prefix: repo tools RW+ = @admins RW refs/collab/ = @agents R = @all refs/heads/ never appears in a contributor's rule. This is only sufficient once patches travel under refs/collab/*, so it depends on the revision-refs issue. Wild repos ('repo agents/[a-z].*' with C = @agents, RW+ = CREATOR) let agents create their own namespaces without a central allocator, which removes the need for any server-level authority over repo creation. A push to settings.git is validated before it takes effect - config must parse, keys must be well-formed, and at least one principal must retain RW+ on settings. This deletes the malformed-policy and bounded-staleness failure paths entirely. Prerequisites: pass the authenticated principal into git-receive-pack's environment, and read the child's stderr (session.rs:708-716) which is currently piped and discarded. Wild repos also force the HTTP resolution rework, since discover is non-recursive (repos.rs:217) and HTTP resolves by final path component (repos.rs:241). Removes server.toml; --repos-dir, --http-bind and --ssh-bind become startup flags. --- Migrated from git-collab issue `20c577fc752ede71b8f1ab63a8644835e81d94a5`. Original author: a73x <dev@a73x.sh>. Close reason: merged in patch b6dcbb7b