didericis/bot-bottle
1
0
Fork 0
Code Issues 25 Pull Requests 9 Actions Packages Projects Releases Wiki Activity

feat(git-gate+orchestrator): slice 13c(v) — provision git-gate into the running gateway #375

Closed
didericis-claude wants to merge 1 commits from orchestrator-gateway-provision into orchestrator-gateway-network
pull from: orchestrator-gateway-provision
merge into: didericis:orchestrator-gateway-network
Conversation 1 Commits 1 Files Changed 2
+205
didericis-claude commented 2026-07-13 21:59:37 -04:00
Collaborator
Copy Link
Copy Source

Sub-slice of slice 13c. The execution side of 13c(i)'s provisioning render: places a bottle's git-gate credentials + bare repos into the live shared gateway container when it registers.

Changes

  • provision_git_gate(gateway, bottle_id, plan) — mkdir the per-bottle creds dir, docker cp each upstream's identity key (+ known_hosts when present) into /git-gate/creds/<bottle_id>/, then docker exec the namespaced, init-only script from git_gate_render_provision. No-op with no upstreams.
  • deprovision_git_gate(gateway, bottle_id) — rm the bottle's /git/<id> + creds on teardown (idempotent).
  • bottle_id is validated (shell/path-safe alphabet) before any docker cp/rm — the creds/repo dirs land in docker cp/rm path arguments, so a traversal id must never reach a path arg. Registry ids are token_hex; defense in depth at the docker boundary.

Verification

pyright 0 errors, pylint 9.83/10 (new files 10.00), unit suite green (1751 tests; the 13 test_sidecar_init /bin/sleep errors are pre-existing NixOS-local noise). Tests cover key+known_hosts copy, known_hosts-absent, no-upstreams no-op, docker-failure, and unsafe-id-rejected-before-any-docker.

Stacked on #374.

🤖 Generated with Claude Code

Sub-slice of **slice 13c**. The execution side of 13c(i)'s provisioning render: places a bottle's git-gate credentials + bare repos into the **live shared gateway container** when it registers. ### Changes - **`provision_git_gate(gateway, bottle_id, plan)`** — `mkdir` the per-bottle creds dir, `docker cp` each upstream's identity key (+ known_hosts when present) into `/git-gate/creds/<bottle_id>/`, then `docker exec` the namespaced, init-only script from `git_gate_render_provision`. No-op with no upstreams. - **`deprovision_git_gate(gateway, bottle_id)`** — `rm` the bottle's `/git/<id>` + creds on teardown (idempotent). - **`bottle_id` is validated** (shell/path-safe alphabet) **before any `docker cp`/`rm`** — the creds/repo dirs land in `docker cp`/`rm` path arguments, so a traversal id must never reach a path arg. Registry ids are token_hex; defense in depth at the docker boundary. ### Verification pyright **0 errors**, pylint **9.83/10** (new files 10.00), unit suite green (1751 tests; the 13 `test_sidecar_init` `/bin/sleep` errors are pre-existing NixOS-local noise). Tests cover key+known_hosts copy, known_hosts-absent, no-upstreams no-op, docker-failure, and unsafe-id-rejected-before-any-docker. Stacked on #374. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
didericis-claude added 1 commit 2026-07-13 21:59:39 -04:00
feat(git-gate+orchestrator): slice 13c(v) — provision git-gate into the running gateway
lint / lint (push) Successful in 2m16s
Details
test / unit (pull_request) Successful in 1m8s
Details
test / integration (pull_request) Successful in 29s
Details
test / coverage (pull_request) Successful in 1m21s
Details
20e83258bf 
Places a bottle's git-gate credentials + bare repos into the live shared
gateway container when it registers — the execution side of the 13c(i)
provisioning render.

- provision_git_gate(gateway, bottle_id, plan): mkdir the per-bottle creds
  dir, docker cp each upstream's identity key (+ known_hosts when present)
  into /git-gate/creds/<bottle_id>/, then docker exec the namespaced,
  init-only script from git_gate_render_provision. No-op with no upstreams.
- deprovision_git_gate(gateway, bottle_id): rm the bottle's /git/<id> +
  creds on teardown (idempotent).
- bottle_id is validated (shell/path-safe alphabet) BEFORE any docker cp/rm,
  so a traversal id can never reach a path arg — the creds/repo dirs land in
  docker cp/rm arguments. Registry ids are token_hex; defense in depth.

pyright 0 errors; pylint 9.83/10; unit suite green (the 13 test_sidecar_init
/bin/sleep errors are pre-existing NixOS-local noise).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck
didericis-claude commented 2026-07-14 00:57:42 -04:00
Author
Collaborator
Copy Link
Copy Source

Collapsed into the single stack PR #380 (per-host orchestrator, PRD 0070). Closing this slice PR; review + merge happens on #380.

Collapsed into the single stack PR #380 (per-host orchestrator, PRD 0070). Closing this slice PR; review + merge happens on #380.
didericis-claude closed this pull request 2026-07-14 00:57:43 -04:00
Some checks are pending
lint / lint (push) Successful in 2m16s
Details
test / unit (pull_request) Successful in 1m8s
Details
test / integration (pull_request) Successful in 29s
Details
test / coverage (pull_request) Successful in 1m21s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
didericis-claude (didericis (claude)) didericis-codex (didericis (codex)) didericis-gemma (gemma) didericis
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: didericis/bot-bottle#375
Delete Branch "orchestrator-gateway-provision"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?