feat(git): add a short-lived Gitoxide admission helper - #3561
Conversation
|
Addressed the unsupported-format admission gap at the open-error boundary.
I also tested the adjacent replacement-ref identity hypothesis. With Verification: 4/4 Rust protocol tests pass; ASF header audit and diff check pass. 中文说明已在 repository open-error 边界修复未知 object format 的分类缺口。
同时验证了相邻的 replacement-ref 身份假设：存在 验证结果：Rust 协议测试 4/4 通过，ASF header audit 与 diff check 通过。 |
|
The follow-up Gitoxide validation stack is now complete as three narrowly scoped stacked Drafts:
The combined real-helper contract now covers, on the same Runtime Host path:
The three-platform workflow builds the real Rust helper and runs the artifact, invocation, and admission contracts. These PRs intentionally remain Draft: they do not claim a signed packaged-release trust root, a protected installation root, Desktop/CLI consumption, T1 persistence, source import, projection, candidate, or ref CAS. Those are production integration gates, not hidden assumptions in the helper validation stack. 中文说明Gitoxide 后续验证链已经按三个窄边界完成：
联合真实 helper 合同已经证明：伪造 claim、错误 owner、symlink/junction、admission 后字节变化全部 fail closed；helper 使用固定 argv、最小环境、I/O 上限、超时/取消且不经过 shell；exit 0/1/2 严格对应 SHA-1 observation、稳定 operational failure、unsupported-format policy rejection；裸 path/OID 不能自证 admission；SHA-256 默认拒绝且不签发 capability。 三平台 workflow 会构建真实 Rust helper，并运行 artifact、invocation、admission 合同。这些 PR 仍保持 Draft，因为正式发布签名信任根、受保护安装路径、Desktop/CLI、T1、source import、projection/candidate/ref CAS 尚未接入；这些是后续生产接线门槛，不是当前验证栈里的隐藏假设。 |
b48b53d to
98d5106
Compare
98d5106 to
3453011
Compare
1 participant
Summary
Introduce a one-request/one-response Gitoxide helper for repository admission without restoring the retired bundled-Git or system-Git execution seams.
The helper:
gix::open::Options::isolated()with strict configuration;Primary invariant
Before any managed-workspace durable mode or T1 selection, the Git backend can fail closed on unsupported repository object formats without invoking or falling back to system Git.
Owner: the single helper process invocation.
Atomicity boundary: one read-only observation from one isolated repository handle.
Failure states: exit 2 for policy rejection; exit 1 for stable operational errors.
Rollback: none, because this slice is read-only.
Scope
This is intentionally a Draft validation slice. It has no Desktop, CLI, Runtime Host, or M2 production consumer and does not implement source import, projection, candidate CAS, Write/Edit, or resume. A later slice must verify the helper artifact identity and convert an observation into an owner-issued opaque admission capability.
Verification
PATHand hostile Git config environment.中文说明
摘要
本 PR 引入一个“一次请求、一次响应、随后退出”的 Gitoxide helper，用于 repository admission；不会恢复已经废弃的 bundled Git 或 system Git 执行入口。
Helper 使用隔离且 strict 的 Gitoxide repository handle，返回 SHA-1 仓库的 exact HEAD commit/tree；SHA-256 与未知格式在 observation 发行前稳定拒绝。它不监听 socket、不复用 handle，也不持有 durable state，因此不是常驻 broker。
主要不变量
在选择 managed-workspace durable mode 或写入 T1 以前，Git backend 可以对不支持的 object format fail closed，并且不得调用或回退系统 Git。
Owner 是单次 helper 进程；原子性边界是一个隔离 repository handle 的一次只读观察；policy rejection 使用 exit 2，operational failure 使用 exit 1；因为只读，所以没有 rollback。
范围
该 PR 有意保持 Draft。当前没有 Desktop、CLI、Runtime Host 或 M2 生产消费者，也不实现 source import、projection、candidate CAS、Write/Edit 或 resume。后续切片必须验证 helper artifact identity，并把 observation 转换成 owner-issued opaque admission capability。
验证
PATH并注入恶意 Git config。