feat(git-gate+orchestrator): slice 13c(i) — per-bottle git-gate provisioning render #371

2026-07-13T21:16:16-04:00

didericis-claude commented

2026-07-13 21:16:16 -04:00

Sub-slice of slice 13c (docker launch integration — the git-gate side). The consolidated gateway serves every bottle's repos under /git/<bottle_id>/ (slice 10), so each bottle's bare repos + per-repo credential config must be provisioned into that namespace. This adds the renderer; placing the creds + running it inside the gateway is the launch-wiring step.

Changes

Extract the credential-wiring init_repo shell into a shared _git_gate_init_repo_fn(repo_root, creds_dir) — one source for the security-sensitive logic. The single-tenant daemon entrypoint is byte-unchanged (still /git + /git-gate/creds; existing tests green).
git_gate_render_provision(bottle_id, upstreams) — posix-sh that inits ONE bottle's bare repos under /git/<bottle_id>/, reading creds from /git-gate/creds/<bottle_id>/. Init-only (no git daemon — the shared gateway already serves). Isolating each bottle's repo root + creds dir by id is what keeps one bottle's push credentials out of another's repos on the shared gateway.
bottle_id is embedded unquoted in the script, so it's restricted to a shell/path-safe alphabet (registry ids are token_hex; defense in depth).

Tests

Provision render namespaces repos + creds by bottle id, one init_repo per upstream, no daemon, installs the pre-receive hook, rejects unsafe ids; plus a guard test that the refactor left the single-tenant entrypoint output intact.

Verification

pyright 0 errors, pylint 9.83/10 (changed files 10.00), unit suite green (1724 tests; the 13 test_sidecar_init /bin/sleep errors are pre-existing NixOS-local noise).

Stacked on #370.

🤖 Generated with Claude Code

Sub-slice of **slice 13c** (docker launch integration — the git-gate side). The consolidated gateway serves every bottle's repos under `/git/<bottle_id>/` (slice 10), so each bottle's bare repos + per-repo credential config must be **provisioned into that namespace**. This adds the renderer; placing the creds + running it inside the gateway is the launch-wiring step. ### Changes - Extract the credential-wiring `init_repo` shell into a shared **`_git_gate_init_repo_fn(repo_root, creds_dir)`** — one source for the security-sensitive logic. The single-tenant daemon entrypoint is **byte-unchanged** (still `/git` + `/git-gate/creds`; existing tests green). - **`git_gate_render_provision(bottle_id, upstreams)`** — posix-sh that inits ONE bottle's bare repos under `/git/<bottle_id>/`, reading creds from `/git-gate/creds/<bottle_id>/`. **Init-only** (no `git daemon` — the shared gateway already serves). Isolating each bottle's repo root + creds dir by id is what keeps one bottle's push credentials out of another's repos on the shared gateway. - `bottle_id` is embedded unquoted in the script, so it's restricted to a shell/path-safe alphabet (registry ids are token_hex; defense in depth). ### Tests Provision render namespaces repos + creds by bottle id, one `init_repo` per upstream, no daemon, installs the pre-receive hook, rejects unsafe ids; plus a guard test that the refactor left the single-tenant entrypoint output intact. ### Verification pyright **0 errors**, pylint **9.83/10** (changed files 10.00), unit suite green (1724 tests; the 13 `test_sidecar_init` `/bin/sleep` errors are pre-existing NixOS-local noise). Stacked on #370. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

didericis-claude added 1 commit 2026-07-13 21:16:17 -04:00

feat(git-gate+orchestrator): slice 13c(i) — per-bottle git-gate provisioning render

lint / lint (push) Successful in 2m9s

Details

test / unit (pull_request) Successful in 1m8s

Details

test / integration (pull_request) Successful in 23s

Details

test / coverage (pull_request) Successful in 1m14s

Details

d0b35b5506

The consolidated gateway serves every bottle's repos under /git/<bottle_id>/
(slice 10), so each bottle's bare repos + per-repo credential config must be
provisioned into that namespace. This adds the renderer for that; placing
the creds + running it inside the gateway is the launch-wiring step.

- Extract the credential-wiring `init_repo` shell into a shared
  `_git_gate_init_repo_fn(repo_root, creds_dir)` — one source for the
  security-sensitive logic. The single-tenant daemon entrypoint is
  byte-unchanged (still /git + /git-gate/creds; existing tests green).
- git_gate_render_provision(bottle_id, upstreams): posix-sh that inits ONE
  bottle's bare repos under /git/<bottle_id>/ reading creds from
  /git-gate/creds/<bottle_id>/. Init-only (no `git daemon` — the shared
  gateway already serves). Isolating each bottle's repo root + creds dir by
  id is what keeps one bottle's push credentials out of another's repos.
- bottle_id is embedded unquoted in the script, so it's restricted to a
  shell/path-safe alphabet (registry ids are token_hex; defense in depth).

pyright 0 errors; pylint 9.83/10; unit suite green (1724 tests; the 13
test_sidecar_init /bin/sleep errors are pre-existing NixOS-local noise).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

didericis-claude referenced this pull request

2026-07-13 21:20:29 -04:00

feat(orchestrator): slice 13c(ii) — shared-gateway source-IP allocator #372

didericis approved these changes 2026-07-13 22:04:43 -04:00

didericis-claude commented

2026-07-14 00:57:35 -04:00