Bootstrap governance without changing what the server exposes #95

Merged

a73x merged 1 commit from worktree-agent-a69e9ab70b4a571cb into main

2026-08-13 15:01:11 +00:00

a73x commented

2026-08-13 14:57:47 +00:00

(Migrated from git.a73x.sh)

Adds git-collab-server setup --config <path> --admin-key <file|->, the
missing bootstrap: governance shipped in b6dcbb7b and the exposure model in
1beeb03e, and nothing could create a settings.git. The live deployment proved
it — five repositories, no settings repo, governance entirely inert.

An explicit command, never a startup step. Creating settings.git is what puts
the inverted default in force, so a server that seeded one on boot would make
every repository invisible the moment it upgraded.

Which is why the seed reproduces the policy already in force: it reads each
repository's server.toml and writes the rule that means the same thing today,
including R = @anonymous and option listed = yes where the repo is public.
Enabling governance is behaviourally a no-op.

That claim is asserted end to end — stand up a server with repositories of
differing visibility, capture what each exposes over HTTP, run setup, assert
listed/readable/clonable are unchanged for every one. Both mutations of the
generator (closing everything, opening everything) fail that test, so it has
teeth. It is also machine-checked in-process before anything is written, by
parsing the generated rules and asking the real evaluator.

Both files land in one commit, put through check_roster_has_rules and
validate_settings_tree — the same validation a push faces — so setup cannot
hand-create the roster-without-rules state that guard exists to prevent.

Also: refuses when settings.git exists, --dry-run, reports the derived
identity (and proves it works by pushing settings over SSH as that principal),
and leaves authorized_keys alone.

One spec gap found and handled: server.toml has two anonymous switches ([ui]
anonymous and [http] anonymous_clone) and the rule language has one grant
covering both, so a repository setting them differently has no faithful
translation. Setup writes the closed answer and names the repository in the
report and in a comment in the file — a bootstrap may narrow exposure, never
widen it by guessing.

Migrated from git-collab patche 0065cd957ee21a990204ac36c689ec3bbffd692b.

Original author: a73x dev@a73x.sh.

Fixes #87

Revision 1: 690c31f46ee29825da4f366bb0f707038b00c944; base 9a13fc36a85adc6fc8bf9fcd05de2f842ca6e0cf

Adds `git-collab-server setup --config <path> --admin-key <file|->`, the missing bootstrap: governance shipped in b6dcbb7b and the exposure model in 1beeb03e, and nothing could create a settings.git. The live deployment proved it — five repositories, no settings repo, governance entirely inert. An explicit command, never a startup step. Creating settings.git is what puts the inverted default in force, so a server that seeded one on boot would make every repository invisible the moment it upgraded. Which is why the seed reproduces the policy already in force: it reads each repository's server.toml and writes the rule that means the same thing today, including `R = @anonymous` and `option listed = yes` where the repo is public. Enabling governance is behaviourally a no-op. That claim is asserted end to end — stand up a server with repositories of differing visibility, capture what each exposes over HTTP, run setup, assert listed/readable/clonable are unchanged for every one. Both mutations of the generator (closing everything, opening everything) fail that test, so it has teeth. It is also machine-checked in-process before anything is written, by parsing the generated rules and asking the real evaluator. Both files land in one commit, put through `check_roster_has_rules` and `validate_settings_tree` — the same validation a push faces — so setup cannot hand-create the roster-without-rules state that guard exists to prevent. Also: refuses when settings.git exists, `--dry-run`, reports the derived identity (and proves it works by pushing settings over SSH as that principal), and leaves authorized_keys alone. One spec gap found and handled: server.toml has two anonymous switches ([ui] anonymous and [http] anonymous_clone) and the rule language has one grant covering both, so a repository setting them differently has no faithful translation. Setup writes the closed answer and names the repository in the report and in a comment in the file — a bootstrap may narrow exposure, never widen it by guessing. --- Migrated from git-collab patche `0065cd957ee21a990204ac36c689ec3bbffd692b`. Original author: a73x <dev@a73x.sh>. Fixes #87 Revision 1: `690c31f46ee29825da4f366bb0f707038b00c944`; base `9a13fc36a85adc6fc8bf9fcd05de2f842ca6e0cf`