HUB-EXCHANGE-OVER-GIT 2: a site fetches from its hub over plain git #58

Every way down from a site's hub is now a plain git fetch over a socket the admin thread makes, instead of a bundle.

• The hub side's serve_site_fetch keeps the two refusals it had, then runs the hub's own upload-pack, shown only the one ref asked for, with HEAD hidden, inside the exchange's time bound.
• The site side fetches that ref into FETCH_HEAD alone with fsck on, screens its commit for escaping symlinks, and only then points its ref at it. Merge, reset, restore and the start's take each fetch this way.
• The site's own git config cannot widen the fetch: no bundle URI, no remote ref mapping, no tags, the fd transport alone, and a config that lowers the fetch's fsck is refused. The test probe asks for a merge or a reset as a whole.
• The bundles and their helpers are removed, and a site's start removes, once, what an older version's bundles left behind.

---

HUB-EXCHANGE-OVER-GIT, subunit 2. Plan: https://tangled.org/notplants-bot.bsky.social/lichen-orchestrator/blob/main/machine-docs/plans/HUB-EXCHANGE-OVER-GIT-2026-11-01.md

This is a reading copy: only this subunit's product changes, applied in order on its base. Nothing here is to be merged.

Source PRs on lichen.page.review (product), in order, with their original descriptions #

• #3593 s/962-hxg-u2-down-over-git — Fetch from the hub over git, the down door's bundles gone

  Every way down from a site's hub is now a plain git fetch over a socket the admin thread makes. The hub side's serve_site_fetch keeps today's two refusals, then runs the hub's own upload-pack shown the one ref asked, with HEAD hidden, within the exchange's time bound. The site side fetches that ref into FETCH_HEAD alone with fsck on, screens its commit for escaping symlinks, and only then points its ref at it; merge, reset, restore and the start's take each fetch so. The site's own git config cannot widen the fetch: no bundle URI, no remote's ref mapping, no tags, the fd transport alone, and a config that lowers the fetch's fsck is refused. The test probe asks for a merge or a reset whole. The bundles and their helpers go; a site's start removes what an older lichen's bundles left, once.

Commits #

• b6cdbdaf7 HXG 2: hxg-u2-down-over-git (#3593)

Count and shas #

count-product-code-lines 6e637184e312..b6cdbdaf7fe2: NET -152 · counted +302 -454 · moved out of the counted set +0 · comment-only deletions flagged 100 · macros flagged 0 · tests-folder code flagged 0

Base 6e637184e312df13515d075cee22700c55e9090e (tip of s/967-od-u5b-runtime-tests). Head b6cdbdaf7fe292118957d4ec22838dd2ee862a6d. 15 files changed.

Check #

Every changed file is a file one of the product PRs changed, and each is identical at the head to the same file at the last product branch s/962-hxg-u2-down-over-git.

Resolved/noted: #3593: the source branch also contains merges of unit 1's tests branch and of stack. Those merges are not included here: only the branch's own commits (0bb4b341, 13c306b7, 1c1e0f85, 470ee905, 72e465dc, e88c260a, f1499371, 4f053de6, 82b80b0e) were applied, one by one, on the base. The head's files are identical to the source branch's.