lichen.page.october
lichen.page.review from the reviewed point 0b92cb61 to stack eb5a1653, as one PR per subsystem (review set)
Star 0
Fork 0
Watch

full 06: Git in the site: the site's own repository and its commits #69

Open notplants-bot.bsky.social
targeting full/05-hub from full/06-site-git
Open opened by and assigned to notplants-bot.bsky.social
targeting full/05-hub from full/06-site-git

The site's own git: the working tree's commits, recovery and history, which ran in the front server on 09-23 and now run in lichen-site, in the site's process. The site no longer reaches any remote: it commits, pushes its main into its hub, and takes what its process's admin thread fetched into the hub. Its push, pull, compact and force operations, and the owner's PDS and user-key credentials it used for them, are gone from this code.

AST-verified changes

  • The front server's working-tree git moved into lichen-site (PER-SITE-PROCESS P2c-2b commit 4, 9fe049e0): git/ops.rs and git/site.rs (with their tests) renamed from lichen-server/src/git/ to lichen-site/src/git/, and the push worker with them; hooks.rs and router.rs item by item (PushOutcome, owner_pds_handle, has_remote, should_push, GitState, git_router, …). Checked by ast-checker 9a9c4144 in move mode (run id not recorded): "moves 4 ok (56 moved, 189 carried, 6 renamed, 33 vis)"; adversary rerun (A11334): "equal=true 56 moved/6 renamed/189 carried/33 vis 0 errs". Allowed: 33 visibility widenings declared in the map, lichen_site:: → crate:: in the moved files, one path rewrite (abort_rebase_in_progress). The front server's half (what hooks.rs and router.rs lost) is in #23.
  • git/settings.rs (with its tests) moved from lichen-server to lichen-site, and hermetic_env, SetGitSyncRequest and edit_git_sync_doc into lichen-site/src/git.rs (P2c-2b commit 1d, 10a747b0). Checked (run id not recorded): "3 moved, 32 carried, 5 visibility"; adversary rerun (A11333): equal=true, 0 errors, "1d 3/5" (moved/visibility). Allowed: lichen_site → crate in the moved files; lichen-site/Cargo.toml as an other file. The same commit moved publish/helpers.rs: #24.

Roughly 450 of this PR's 2,268 changed lines are code these moves carried verbatim; the rest is what SITE-FRONT-BOUNDARY then removed or rewrote (the push, pull and credential code), and git diff -M pairs ops.rs as a rename, so most of its moved lines are not counted at all.

On this forge the renamed file here shows as a whole deletion and a whole addition, so its diff reads 4,496 changed lines; with rename detection (git diff -M full/05-hub full/06-site-git) it is 2,268.

On 09-23 the front server ran every site's git itself: lichen-server/src/git/ops.rs committed, pushed and pulled with the owner's credentials (GitAuth::UserDeployKey, GitAuth::Pds), and router.rs served /git/log, status, remote-status, push, pull, revert, force-push, force-pull and compact. PER-SITE-PROCESS P2c-2b moved that code into lichen-site, so a site process runs its own git. SITE-FRONT-BOUNDARY then took every remote out of the site (units 6, 7, 8 and 11b1): the front server pushed the hub to the remote, fetched the remote into the hub, did every rewrite and answered the editor's git panel. FULL-SITE-PROCESS moved that code into lichen-site as well, where the site process's admin thread runs it (#23). What is here is the site's own git, run by its main runtime, which still reaches no remote:

  • Commits and recovery (ops.rs, +242/−1049 against the old file): commits in the tree's transaction, recovery of interrupted layers and of an inherited dirty mark (recover_inherited_mark), with_git_transaction_without_advance for a build's own writes (operator note N1), git_fetch_from_hub (the remote's branch the admin thread fetched, into the site's own refs/remotes/origin/*, no merge), untrack_committed_credentials, and keep_auto_gc_attached (git may not setsid in a site process, SITE-FRONT-BOUNDARY decision 6). Removed: git_push, git_pull, git_fetch, git_compact, git_force_push, git_force_pull, the auth and push helpers.
  • Into the hub (site.rs): commit, commit_build_writes, commit_to_hub and catch_up_published_build. The old push is gone.
  • Routes (router.rs): two, in permission groups: POST /cms/api/git/pds-remote (configure the owner's PDS as the remote) and POST /cms/api/git/commit-to-hub (commit what is dirty and push main into the hub, asked by the admin thread before its push). git_history_router keeps POST /cms/api/git/revert, mounted only on a server with no dashboard.
  • Settings (settings.rs): GitAuth keeps only DeployKey; the user-key and PDS variants are gone, since only the admin thread holds those credentials (the owner's session the front server lends it, and the area's copy of the deploy key; #23).
  • ssh.rs: an SSH remote as git names it (SshRemote::parse), which the owner records through the dashboard and the site process's admin thread pushes to (PER-SITE-PROCESS P3-4); the relay a site's git once ran ssh through is gone.

Files (crates/lichen-site/src/git/ unless named)

  • ops.rs — renamed from lichen-server/src/git/ops.rs; read this first for what the site's git still does.
  • site.rs — new here; the commit and the push into the hub. Its old copy, lichen-server/src/git/site.rs (−107), is deleted.
  • router.rs — the site's git routes, above.
  • settings.rs — the [git] section; its old copy, lichen-server/src/git/settings.rs (−208), is deleted.
  • hooks.rs — what the post-save path keeps: PushOutcome, should_push, has_remote, the PDS remote's setup.
  • ssh.rs — the SSH remote's parse.
  • crates/lichen-site/src/git.rs — the module list (now with the modules FULL-SITE-PROCESS 5b moved in, held by #21, #23, #25 and #28), hermetic_env, SetGitSyncRequest.

Moved in: the deletions of lichen-server/src/git/settings.rs and git/site.rs, placed with the lichen-site files they became (git pairs them only below its default similarity).

Lives elsewhere

  • The hub and the site's push into it (lichen-site/src/git/hub.rs): #21.
  • The push, fetch, rewrites, editor git panel, remote record and SSH, in lichen-site's git/ and admin_area/ and run by the site process's admin thread: #23.
  • A publish's build (git/publish_build.rs): #24.
  • revert as an admin act (lichen-site/src/ipc/git.rs, acts.rs): #19.
  • The git tests (git/tests/*.rs) are in the base commit.

Category: Git in the site: the site's own repository and its commits Size: 9 files, +904/−1,364 Rounds: round 0 at stack ae42e3c0; at 29a7c15b and at 6b650b2a none of this PR's files changed; round 1 at b66397c0 (FULL-SITE-PROCESS): comments name the site process's admin thread where they named the front server (it now pushes, fetches and rewrites), and git.rs declares the modules unit 5b moved into lichen-site's git/. Read this round in its interdiff: https://tangled.org/notplants-bot.bsky.social/lichen.page.october/pulls/22/round/1/interdiff Plans and ledger: PER-SITE-PROCESS-2026-10-09.md (P2c-2b, P3-4); SITE-FRONT-BOUNDARY-2026-10-17.md (units 6, 7, 8, 11b1; decision 6) and its notes -U6-, -U7-, -U8-DESIGN; OPERATOR-REVIEW-REVISIONS-2026-10-13.md (N1). Ledger: lichen-builder B2352 (commit 1d), B2367 (commit 4); lichen-adversary A11333–A11334. Inline #[cfg(test)] modules: none inline; 3 files point to a test file with #[path] (ops.rs, settings.rs, ssh.rs), 1 has test-only items (site.rs). Bucket moves: round 1's Git PR is split in two: the site's own repository here, git with the site's remote (the front server's until FULL-SITE-PROCESS, the admin thread's now) in #23. The two deleted lichen-server files are here with what they became. Round 1: #6 (Git: the front server pushes, fetches and rewrites) covered the lichen-site files from 0b92cb61.

Commits 0