HUB-EXCHANGE-OVER-GIT 3: the site's push allows the fd transport alone, and the docs describe the git exchange #59

The site's push into its hub now runs with GIT_ALLOW_PROTOCOL=fd, as its fetch from the hub already does, so a remote, URL or insteadOf in the site's git config can no longer send that push to the site's own files. The shared helper that runs both gits sets the one transport itself, so its transports argument is gone; every other git the site runs keeps file alone.

Documentation and comments now describe the hub exchange as it runs: plain git push and git fetch over a socketpair the admin thread makes for each exchange. SANDBOX.md and docs/SECURITY.md name HubSocketForTheSite as the one descriptor that crosses into the main runtime, the fd transport for the two hub commands alone, the hub's one receive with its expected command and verdict, the fetch shown one ref with HEAD hidden, the time bound, the relayed receive output, the one-time removal of old bundle files, and keep_ambiguous's create-only update-ref. docs/CMS_EVENTS.md and the event comments say GitCommitted wakes the hub follower; no comment describes a bundle in the exchange any more.

---

HUB-EXCHANGE-OVER-GIT, subunit 3. Plan: https://tangled.org/notplants-bot.bsky.social/lichen-orchestrator/blob/main/machine-docs/plans/HUB-EXCHANGE-OVER-GIT-2026-11-01.md

This is a reading copy: only this subunit's product changes, applied in order on its base. Nothing here is to be merged.

Source PRs on lichen.page.review (product), in order, with their original descriptions #

• #3601 s/980-hxg-u3-close — The hub exchange's close: the site's push allowed fd alone, and the docs over git

  The site's push into its hub now runs with GIT_ALLOW_PROTOCOL=fd, as its fetch from the hub already does. A remote, a URL or an insteadOf in the site's git config can no longer send that push to the site's own files. The shared helper that runs both gits sets the one transport itself, so its transports argument is gone. Every other git the site runs keeps file alone.

  The docs now describe the hub exchange as it runs: plain git push and git fetch over a socketpair the admin thread makes for each exchange. SANDBOX.md names the site's end of the socket (HubSocketForTheSite) as the one descriptor that crosses into the main runtime. It also covers the fd transport for the two hub commands alone, the hub's one receive with its expected command and verdict, the fetch shown one ref with HEAD hidden, the time bound, the relayed receive output and the one-time removal of old bundle files. docs/SECURITY.md's hub rows and its "What crosses" text say the same and name the D-a narrowing. SECURITY.md also names keep_ambiguous's create-only update-ref as a ref move in the hub, beside the up door and rewrite_hubs_main. docs/CMS_EVENTS.md and the CMS events' comments say GitCommitted wakes the hub follower. No doc or product comment describes a bundle in the exchange any more.

Commits #

• 410d95a57 HXG 3: hxg-u3-close (#3601)

Count and shas #

count-product-code-lines 7d9474c5c07e..410d95a57dbd: NET -1 · counted +3 -4 · moved out of the counted set +0 · comment-only deletions flagged 12 · macros flagged 0 · tests-folder code flagged 0

Base 7d9474c5c07e2577dd5a71948838d891c3a94957 (tip of s/974-od-u6d-save-fixture-tests). Head 410d95a57dbdef2397d84d4602795b5deec0bd08. 9 files changed.

Check #

Every changed file is a file one of the product PRs changed, and each is identical at the head to the same file at the last product branch s/980-hxg-u3-close.

Resolved/noted: #3601: the source branch also contains merges of unit 2's tests branch and of stack. Those merges are not included here: only the branch's own commits (b427a5dc, afc09558, 04b43fd0) were applied, one by one, on the base. The head's files are identical to the source branch's.